Vorpsel / Products / Endpoints
SIEM
The same agent that inventories your machines collects their logs, and a single small agent can receive the logs of your firewalls and switches. Thousands of detection rules run on every event as it arrives, and every event stays searchable for as long as you choose.
At a glance
- One agent for logs, inventory and protection on Windows, Linux and macOS
- 5,000+ detection rules mapped to MITRE ATT&CK, ready on day one
- Network devices by syslog, without a separate collector server
- Retention you choose from a week to years, searchable the whole time
- Alerts by e-mail, Slack, Microsoft Teams, webhook or syslog
Collect, detect, investigate
A traditional SIEM project starts with collectors, parsers and months of rule writing before the first useful alert. Vorpsel starts from the agent you install for vulnerability management and ships the detection already written.
Collect
Turn on log collection per machine. The agent sends system and security logs, programs started and changes to important files, over an encrypted connection.
Detect
Every event is put in one format and checked against the detection rules as it arrives. A match becomes an alert with its severity and the attacker technique it suggests.
Investigate
From the alert, open the events around it on the same machine or search across every machine and period, with a query language made for security questions.
What flows in
Windows
Security, system, application, PowerShell and Defender logs
Linux and macOS
System journal, authentication, sudo and audit logs
Your own log files
Any application log you point the agent to, per group of machines
Containers
Containers created, started, stopped and commands run inside them
Network devices
Firewalls, switches and appliances, by syslog to an agent you choose
File integrity
Changes to the files and registry keys that matter, with who made them
What is included
One event format
A failed logon looks the same whether it came from Windows, Linux or a VPN appliance: the same fields for who, from where and what happened. One search finds it everywhere.
- Fields named by what they mean, such as user, source address and process, not by the product that produced them
- The original message kept next to the normalized fields, for evidence and for anything the format does not cover
Detection you can tune
More than 5,000 detection rules from the security community and our own team, mapped to MITRE ATT&CK and ready on day one. Every environment is different, so every rule can be adjusted without being copied or rewritten.
- Turn off Switch off any rule for your account; its past alerts stay.
- Change the level Make a rule critical or low for your environment, without editing it.
- Add exceptions Silence a rule for a machine, account, address or path, with the reason kept.
- Write your own Upload rules in the common open YAML format; they are checked and live within seconds.
Correlations
Brute force, password spraying and other patterns that only appear across many events.
- Many failed logons against one account, or one failed logon against many accounts
- A successful logon right after a series of failures from the same address
Search every event
Investigations need the raw history, not only the alerts. Every event can be searched by any field, over any period you keep, and the result exported for a report or another tool.
- Filters written as object and attribute, such as the user, the process or the source address
- The events before and after an alert on the same machine, opened from the alert
Kept as long as you need, sent where you work
Retention you choose
Events stay searchable for the period in your contract, from a week to years, and older events move to low-cost storage instead of being deleted.
Alerts where your team is
Each alert channel chooses its events and minimum severity. Webhooks are signed, so your systems can trust them.
E-mail, Slack, Microsoft Teams, Webhook, Syslog CEF
Questions
Do we need a separate server to collect logs?
No. Machines send their own logs through the agent. For devices that cannot run an agent, such as firewalls, you choose one machine with the agent to receive their syslog and forward it.
How is the SIEM different from the EDR?
The SIEM reads what your systems record: logs, changes to important files and the syslog of network devices. The EDR watches what runs on the machine, such as programs, connections, name lookups and malware, and can act on it. Both use the same agent and are turned on per machine.
How is the price calculated?
By the number of machines with log collection turned on. There is no charge per gigabyte, so a busy day does not change your bill.
Can we use the SIEM without vulnerability management?
Yes. Each product is turned on per machine. The agent is the same, so adding the other later needs no new installation.
Is the data separated from other customers?
Yes. Every event is stored and searched with the account it belongs to, and the agent sends it over an encrypted connection with its own credential.
Related products
Start with the machines you already have.
If the agent is installed for vulnerability management, turning on the SIEM is one switch per machine.